so you'd write a new role to an Admin service, and that service would produce a kafka event that could be picked up by both the audit service and by a consumer that writes to spicedb